Roger,
As long as the message continues to clear you should be ok. The big concern is to make sure it doesn't rise much further. When the message broker hits 80% the rabbitmq service will usually shutdown to protect itself and the data in the broker. The priority for dealing with the issue also depends on where you are seeing it. For instance if you are seeing it coming from a remote log collector it becomes more of a concern as rabbitmq is the way it transfers logs from the remote collector back to a log decoder. If the alarm is on a concentrator it is health & wellness messages from the services on the concentrator.
We usually see these kinds of alarms more on log decoders and the connecting remote log collectors. If this is what you are seeing the issue is usually due to a spike in events per second from event sources reporting to the collector. Since the alarm comes and goes this is more likely what you are seeing. I would look closely at the remote collector or the log decoder to confirm this when you see the alarm. If the alarm happens often, especially during high usage times such as first thing in the morning or around lunch time, you may want to look into adding additional remote collectors or log decoders to handle these spikes better.
If you are not seeing spikes when the alarm fires you may want to contact Netwitness Support to determine if there is another issue happening within your environment.
I hope this helps answer your question and gives you a better idea of what may be going on when you see this alarm.
